CVE-2026-67314

Name of the Vulnerable Software and Affected Versions axios versions 1.15.2 through 1.17.x

Description axios contains prototype-pollution read-side gadgets in its Basic authentication subfield handling within lib/adapters/http.js and lib/helpers/resolveConfig.js. While axios does not pollute prototypes itself, it is vulnerable if the host application is already affected by a separate prototype-pollution primitive. When a request is made using an auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values to construct the outbound 'Authorization: Basic ...' header.

This allows an attacker who controls the polluted prototype values to perform outbound request tampering by injecting attacker-chosen Basic auth credentials or replacing an existing Authorization header. Under specific application conditions, this could lead to credential disclosure.

Recommendations Avoid passing empty or partial auth objects; only set auth when the application has its own username and password values. Applications that merge untrusted input should filter proto, constructor, and prototype keys. Read optional user options using own-property checks instead of patterns like opts.auth || {}. When a wrapper must materialize optional authentication, use a null-prototype object or explicitly copy only own fields.